CKS — Cluster Setup & Hardening
Chapter Overview
Domain 1 — Cluster Setup accounts for 10% of the CKS exam. Despite being the lowest-weighted domain, it covers foundational security controls that every other domain builds upon. Weak cluster setup means every subsequent layer of defense starts compromised.
This chapter focuses on the network perimeter and platform integrity controls that secure a Kubernetes cluster before workloads are even deployed. You’ll configure NetworkPolicies to segment traffic, enforce TLS on Ingress, protect cloud metadata endpoints, lock down GUI access, and verify the integrity of Kubernetes binaries.
Every topic maps directly to a CKS exam objective. The hands-on lab at the end ties all concepts together in a realistic scenario.
CKS Exam Domain
| Property | Value |
|---|---|
| Domain | Domain 1 — Cluster Setup |
| Weight | 10% |
| Focus | Network security, TLS, metadata protection, GUI hardening, binary verification |
| Exam Tasks | Configure NetworkPolicies, set up Ingress TLS, restrict metadata access, verify binaries |
Strategy: While 10% is the smallest domain, these topics frequently appear as quick wins on the exam. A well-practiced candidate can score full marks here in under 10 minutes — freeing time for heavier domains like Supply Chain Security (20%) and Runtime Security (20%).
What You’ll Learn
| # | Topic | Description |
|---|---|---|
| 1 | NetworkPolicies for Cluster Access | Default deny, DNS egress, API server restriction, kube-system protection |
| 2 | Ingress TLS Configuration | TLS Secrets, Ingress TLS termination, HTTP→HTTPS redirect |
| 3 | Node Metadata Protection | Block cloud metadata endpoints (169.254.169.254) via NetworkPolicy |
| 4 | GUI Access Control | Dashboard security, RBAC restrictions, secure alternatives |
| 5 | Platform Binary Verification | sha512sum verification of kubectl, kubeadm, kubelet |
| 6 | Hands-On Lab | End-to-end lab covering all Cluster Setup topics |
How This Chapter Maps to the Exam
The CKS exam curriculum lists the following objectives under Cluster Setup:
- Use NetworkPolicy to restrict cluster-level access — Covered in Topics 1 and 3
- Use CIS benchmark to review the security configuration of Kubernetes components — Covered in Chapter 3 (Cluster Hardening)
- Properly set up Ingress objects with security control — Covered in Topic 2
- Protect node metadata and endpoints — Covered in Topic 3
- Minimize use of, and access to, GUI elements — Covered in Topic 4
- Verify platform binaries before deploying — Covered in Topic 5
Note: CIS benchmark scanning (kube-bench) is listed under Cluster Setup in some curriculum versions but is covered in the Cluster Hardening chapter of this tutorial for better topical grouping.
Prerequisites
This chapter assumes you have:
- A working Kubernetes cluster (kubeadm, minikube, or kind)
- CKA-level proficiency with kubectl, RBAC, and networking concepts
- A CNI plugin that supports NetworkPolicy (Calico, Cilium, or Weave Net)
- openssl installed for TLS certificate generation
- Basic understanding of cloud metadata services (AWS IMDS, GCP Metadata)
If any of these feel unfamiliar, revisit the CKA Tutorial before continuing.
Start Learning: NetworkPolicies for Cluster Access →
| ← Introduction | NetworkPolicies → |
